c7ea7e2013b727016b8452a28dde5598fb2388d53ac11f48f3904b8d239e60b2

Analysis

max time kernel
1562s
max time network
1563s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image.png
Size

245KB
MD5

040e9d63c140ca10f645ae84dbc3010b
SHA1

03e0bedee0a72687d8ee48e2cac96cbaac9eee3e
SHA256

c7ea7e2013b727016b8452a28dde5598fb2388d53ac11f48f3904b8d239e60b2
SHA512

c3806d8bbdb04c129c48c4f8ed630afed3171e9e99c370107fab8cb6d14ea2422fa5f5577644ba4c9870ab2ff7bbef0339ce8da0dc0fea5a440c23a8e1826a9d
SSDEEP

6144:+WpLseNOyLi7kAlKWhOp1hOgT69nAeuhz8ZJgomIqz:1QeNOyeGn6xAeuSmI+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1280-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download